fix: check for git directly instead of relying on CI=true

[panish16]

Improves on #2364's guard, per feedback from Thor and Patrick that lefthook shouldn't be attempting to run in CI/CD at all, not just fail-safe.

What changed

- "prepare": "lefthook install || exit 0"
+ "prepare": "git --version && lefthook install || exit 0"

Why not CI=true

lefthook's own npm postinstall already skips itself under CI=true by default. First tried making prepare do the same, but confirmed on bcgov/bcregistry#282 - via a real CD run, not assumption - that Google Cloud Build doesn't set CI=true at all, so that check would have silently stayed broken there. Checking for git's actual presence avoids depending on any CI provider's conventions and matches the actual failure mode.

Note: this repo's CD/CI (ppr-ui-cd.yml, ppr-ui-ci.yml) is path-scoped to ppr-ui/**, so a root-only change like this one doesn't trigger either and can't be proven through a real pipeline run the way #282 was. Verified locally instead with real git commit: hook installs when git is present, blocks a fake secret whether it's at repo root or nested under a subfolder.

Update: Windows fix

The original command -v git >/dev/null 2>&1 && lefthook install || true guard silently did nothing on Windows. pnpm/npm run lifecycle scripts through cmd.exe there by default, command -v and /dev/null don't exist, and the failure fell through to || true, so the install exited 0 but no hook was installed. Windows devs would have had no secret scanning and no error telling them so.

Replaced with:

"prepare": "git --version && lefthook install || exit 0"

Same semantics (skip entirely when git is absent, never fail the install), works in both cmd.exe and POSIX sh. Verified all four combinations (cmd.exe / sh, git present / absent), plus a real git commit with a fake token on Windows is blocked.

[panish16]

/gcbrun